High severityOSV Advisory· Published Sep 22, 2025· Updated Apr 15, 2026

CVE-2025-10009

Description

Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to execute arbitrary code on the server via uploaded .php files.

Affected products

Invoiceninja/InvoiceninjaOSV
Range: 5.8.56, v5.0, v5.0.1, …

Patches

02151b570b22

https://github.com/invoiceninja/invoiceninjavia osv

commit

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

github.com/invoiceninja/invoiceninja/commit/02151b570b226b4584a8e61b06b10be9366da3denvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000